Week 25, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.3
  CVE-2025-5777 NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

  NetScaler · ADC · Gateway

  EPSS 100%
• Critical 10.0
  CVE-2025-49132 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

  pterodactyl · panel

  EPSS 54%
• Critical 10.0
  CVE-2025-34030 sar2html OS Command Injection

  sar2html · sar2html

  EPSS 52%
• Critical 9.8
  CVE-2025-6216 Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability

  Allegra · Allegra

  EPSS 48%
• Critical 9.9
  CVE-2025-23121 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

  Veeam · Backup and Recovery

  EPSS 26%
• Critical 9.8
  CVE-2025-49213 An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected …

  Trend Micro · Trend Micro Endpoint Encryption Policy Server

  EPSS 13%
• Critical 9.8
  CVE-2025-49212 An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected …

  Trend Micro · Trend Micro Endpoint Encryption Policy Server

  EPSS 13%
• Critical 9.8
  CVE-2025-49825 Teleport allows remote authentication bypass

  gravitational · teleport

  EPSS 7.9%
• Critical 9.3
  CVE-2025-25038 MiniDVBLinux Root Command Injection

  MiniDVBLinux · MiniDVBLinux

  EPSS 5.6%
• Critical 9.3
  CVE-2025-25034 SugarCRM PHP Deserialization RCE

  SugarCRM · SugarCRM

  EPSS 5%
• Critical 9.8
  CVE-2025-50201 WeGIA OS Command Injection in debug_info.php parameter 'branch'

  LabRedesCefetRJ · WeGIA

  EPSS 4.7%
• Critical 9.4
  CVE-2025-34024 Edimax EW-7438RPn Mini OS Command Injection via mp.asp

  Edimax · Edimax EW-7438RPn Mini

  EPSS 3.9%
• Critical 9.4
  CVE-2025-34029 Edimax EW-7438RPn Mini OS Command Injection via syscmd.asp

  Edimax · Edimax EW-7438RPn Mini

  EPSS 3.5%
• Critical 9.8
  CVE-2025-1562 Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitr…

  amans2k · FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce

  EPSS 3.3%
• Critical 9.8
  CVE-2025-6121 D-Link DIR-632 HTTP POST Request get_pure_content stack-based overflow

  D-Link · DIR-632

  EPSS 2.8%

All 70 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.8
  CVE-2025-6218 RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability

  RARLAB · WinRAR

  EPSS 90%
• Medium 6.3
  CVE-2025-34508 ZendTo < 6.15-8 Path Traversal

  ZendTo · ZendTo

  EPSS 75%
• High 7.5
  CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials

  Sitecore · Experience Platform · Experience Manager

  EPSS 56%
• High 8.6
  CVE-2025-52488 DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input

  dnnsoftware · Dnn.Platform

  EPSS 36%
• High 7.5
  CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  Apache Software Foundation · Apache Commons FileUpload

  EPSS 33%
• High 8.8
  CVE-2025-34511 Sitecore PowerShell Extension RCE via Unrestricted Upload

  Sitecore · Powershell Extension

  EPSS 30%
• High 7.5
  CVE-2025-48988 Apache Tomcat: FileUpload large number of parts with headers DoS

  Apache Software Foundation · Apache Tomcat

  EPSS 30%
• High 8.8
  CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

  Sitecore · Experience Platform · Experience Manager · Experience Commerce

  EPSS 25%